Using proof of purchase for multifactor authentication

ABSTRACT

Multifactor authentication techniques described herein may allow a user to submit a recent proof of purchase as a part of a multifactor authentication process to access an account associated with a financial institution. As part of the login process, the user may submit a proof of purchase associated with a transaction. The financial institution may determine information associated with the transaction, such as a merchant associated with the proof of purchase, a time of the transaction, the last four numbers of the transaction card used, a dollar amount, or any combination thereof. If the information matches one or more records in the transaction history of the user&#39;s account, the financial institution may authenticate the user and provide access to the account. In this way, the financial institution may leverage transaction history known to the financial institution and the user to authenticate the user.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application is a continuation of U.S. application Ser. No.16/914,796, filed Jun. 29, 2020 and entitled “Using Proof of Purchasefor Multifactor Authentication,” the entirety of which is hereinincorporated by reference.

FIELD OF USE

Aspects of the disclosure relate generally to authentication and morespecifically to a multifactor authentication using a proof of purchaseas an authentication factor.

BACKGROUND

Issues of account takeover—where a malicious actor gains access to auser's data and/or one of the user's contact methods (e.g., an emailaddress, a phone number, etc.)—typically occur in a short time frame.For instance, the malicious actor may attempt to login via anapplication or website. Alternatively, the malicious actor may phone acall center pretending to be the customer in an attempt to gain accessto an account. In both examples, the malicious actor may attempt to gainaccess to the account, for example, to reset passwords, change accountsettings, etc. While multifactor authentication and security questionsare useful tools in protecting against malicious actors, multifactorauthentication and security questions are both susceptible, for example,due to user information being publicly available or users sharinginformation via social media sites.

SUMMARY

The following presents a simplified summary of various featuresdescribed herein. This summary is not an extensive overview, and is notintended to identify key or critical elements or to delineate the scopeof the claims. The following summary merely presents some concepts in asimplified form as an introductory prelude to the more detaileddescription provided below. Corresponding apparatus, systems, andcomputer-readable media are also within the scope of the disclosure.

The multifactor authentication techniques described herein may allow auser to submit a recent proof of purchase (e.g., a receipt, a UPC code,a SKU number, a photo of the good, etc.) as a part of a multifactorauthentication process. In this regard, a financial institution mayleverage transaction history known to the financial institution and theuser and not, otherwise, generally available to the public. Themalicious actor would not have access to proofs of purchase associatedwith the account that were more than a predetermined age (e.g., olderthan a few hours). Using a recent proof of purchase may improve thesecurity of login attempts at financial institutions and reduce thelikelihood of account takeover attempts being performed successfully.

Methods, devices, systems, and/or computer-readable media describedherein may comprise using a proof of purchase (e.g., a receipt, a UPCcode, a SKU number, a photo of the good, etc.) as part of a multifactorauthentication process. In this regard, a user may submit a proof ofpurchase to establish that the user is a valid accountholder. The usermay submit an image of the proof of purchase, and a server may validatethe proof of purchase and determine information associated with thetransaction. This information may comprise a merchant associated with areceipt, a time of the transaction, the last four numbers of thetransaction card used for the transaction, a dollar amount, or anycombination thereof. The server may compare the information to atransaction history of the user. If a matching transaction is found,then the customer may be verified as a valid accountholder and would begranted permission accordingly. In some examples, itemized data from theproof of purchase may be associated with a transaction.

These features, along with many others, are discussed in greater detailbelow.

BRIEF DESCRIPTION OF THE DRAWINGS

The present disclosure is described by way of example and not limited inthe accompanying figures in which like reference numerals indicatesimilar elements and in which:

FIG. 1 shows an example of a system in which one or more featuresdescribed herein may be implemented;

FIG. 2 shows an example computing device;

FIG. 3 shows an example of a process for performing multifactorauthentication according to one or more aspects of the disclosure;

FIGS. 4A-4C show an example of the multifactor authentication beingperformed on a mobile device in accordance with one or more aspects ofthe disclosure; and

FIGS. 5A-5D show an example of the multifactor authentication beingperformed via a web browser in accordance with one or more aspects ofthe disclosure.

DETAILED DESCRIPTION

In the following description, reference is made to the accompanyingdrawings, which form a part hereof, and in which are shown variousexamples of features of the disclosure and/or of how the disclosure maybe practiced. It is to be understood that other features may be utilizedand structural and functional modifications may be made withoutdeparting from the scope of the present disclosure. The disclosure maybe practiced or carried out in various ways. In addition, it is to beunderstood that the phraseology and terminology used herein are for thepurpose of description and should not be regarded as limiting. Rather,the phrases and terms used herein are to be given their broadestinterpretation and meaning.

By way of introduction, features discussed herein may relate to methods,devices, systems, and/or computer-readable media for leveragingtransaction records for use as part of a multifactor authenticationprocess. Multifactor authentication may use two or more pieces ofknowledge-based factors, possession-based factors, inherent-basedfactors, and/or location-based factors. Knowledge-based factors maycomprise information that the user knows, such as a username, password,personal identification number, etc.; possession-based factors maycomprise something in the user's possession, such as a token, atransaction card, a key card, etc.; and inherent-based factors maycomprise aspects that are unique to the user, such as biometricidentifiers (e.g., facial recognition, fingerprint scans, voiceprints,iris recognition, etc.) and behavioral elements (e.g., keystroke speed);and location-based factors may comprise a user's location, such as ageographic location or a network address. Financial institutions are ina unique position to expand the possession factors to includetransaction history, for example, by permitting a user to submit a proofof purchase (e.g., a receipt, a UPC code, a SKU number, a photo of thegood, etc.) as a part of a multifactor authentication. The financialinstitution may validate the proof of purchase and compare the proof ofpurchase (e.g., the information contained therein) to transactionrecords to verify the user and provide access to the account and/oraccount information. This may improve security, for example, when a useraccesses their account or when the user's device is lost or stolen.Additionally, the techniques described herein may reduce the likelihoodof successful account takeover attempts by a malicious actor.

FIG. 1 shows an example of a system 100 that includes a first userdevice 110, a second user device 120, and a server 130, connected to afirst database 140, interconnected via network 150.

First user device 110 may be a mobile device, such as a cellular phone,a mobile phone, a smart phone, a tablet, a laptop, or an equivalentthereof. First user device 110 may provide a first user with access tovarious applications and services. For example, first user device 110may provide the first user with access to the Internet. Additionally,first user device 110 may provide the first user with one or moreapplications (“apps”) located thereon. The one or more applications mayprovide the first user with a plurality of tools and access to a varietyof services. In some embodiments, the one or more applications mayinclude a banking application that provides access to the first user'sbanking information, as well as perform routine banking functions, suchas checking the first user's balance, paying bills, transferring moneybetween accounts, withdrawing money from an automated teller machine(ATM), and wire transfers. The banking application may comprise anauthentication process to verify (e.g., authenticate) the identity ofthe first user prior to granting access to the banking information.

Second user device 120 may be a computing device configured to allow auser to execute software for a variety of purposes. Second user device120 may belong to the first user that accesses first user device 110,or, alternatively, second user device 120 may belong to a second user,different from the first user. Second user device 120 may be a desktopcomputer, laptop computer, or, alternatively, a virtual computer. Thesoftware of second user device 120 may include one or more web browsersthat provide access to websites on the Internet. These websites mayinclude banking websites that allow the user to access his/her bankinginformation and perform routine banking functions. In some embodiments,second user device 120 may include a banking application that allows theuser to access his/her banking information and perform routine bankingfunctions. The banking website and/or the banking application maycomprise an authentication component to verify (e.g., authenticate) theidentity of the second user prior to granting access to the bankinginformation.

Server 130 may be any server capable of executing banking application132. Additionally, server 130 may be communicatively coupled to firstdatabase 140. In this regard, server 130 may be a stand-alone server, acorporate server, or a server located in a server farm or cloud-computerenvironment. According to some examples, server 130 may be a virtualserver hosted on hardware capable of supporting a plurality of virtualservers.

Banking application 132 may be server-based software configured toprovide users with access to their account information and performrouting banking functions. In some embodiments, banking application 132may be the server-based software that corresponds to the client-basedsoftware executing on first user device 110 and second user device 120.Additionally, or alternatively, banking application 132 may provideusers access to their account information through a website accessed byfirst user device 110 or second user device 120 via network 150. Thebanking application 132 may comprise an authentication module to verifyusers before granting access to their banking information.

First database 140 may be configured to store information on behalf ofapplication 132. The information may include, but is not limited to,personal information, account information, and user-preferences.Personal information may include a user's name, address, phone number(i.e., mobile number, home number, business number, etc.), socialsecurity number, username, password, employment information, familyinformation, and any other information that may be used to identify thefirst user. Account information may include account balances, bill payinformation, direct deposit information, wire transfer information,statements, and the like. User-preferences may define how users receivenotifications and alerts, spending notifications, and the like. Firstdatabase 140 may include, but are not limited to relational databases,hierarchical databases, distributed databases, in-memory databases, flatfile databases, XML databases, NoSQL databases, graph databases, and/ora combination thereof.

First network 150 may include any type of network. In this regard, firstnetwork 150 may include the Internet, a local area network (LAN), a widearea network (WAN), a wireless telecommunications network, and/or anyother communication network or combination thereof. It will beappreciated that the network connections shown are illustrative and anymeans of establishing a communications link between the computers may beused. The existence of any of various network protocols such as TCP/IP,Ethernet, FTP, HTTP and the like, and of various wireless communicationtechnologies such as GSM, CDMA, WiFi, and LTE, is presumed, and thevarious computing devices described herein may be configured tocommunicate using any of these network protocols or technologies. Thedata transferred to and from various computing devices in system 100 mayinclude secure and sensitive data, such as confidential documents,customer personally identifiable information, and account data.Therefore, it may be desirable to protect transmissions of such datausing secure network protocols and encryption, and/or to protect theintegrity of the data when stored on the various computing devices. Forexample, a file-based integration scheme or a service-based integrationscheme may be utilized for transmitting data between the variouscomputing devices. Data may be transmitted using various networkcommunication protocols. Secure data transmission protocols and/orencryption may be used in file transfers to protect the integrity of thedata, for example, File Transfer Protocol (FTP), Secure File TransferProtocol (SFTP), and/or Pretty Good Privacy (PGP) encryption. In manyembodiments, one or more web services may be implemented within thevarious computing devices. Web services may be accessed by authorizedexternal devices and users to support input, extraction, andmanipulation of data between the various computing devices in the system100. Web services built to support a personalized display system may becross-domain and/or cross-platform, and may be built for enterprise use.Data may be transmitted using the Secure Sockets Layer (SSL) orTransport Layer Security (TLS) protocol to provide secure connectionsbetween the computing devices. Web services may be implemented using theWS-Security standard, providing for secure SOAP messages using XMLencryption. Specialized hardware may be used to provide secure webservices. For example, secure network appliances may include built-infeatures such as hardware-accelerated SSL and HTTPS, WS-Security, and/orfirewalls. Such specialized hardware may be installed and configured insystem 100 in front of one or more computing devices such that anyexternal devices may communicate directly with the specialized hardware.

Any of the devices and systems described herein may be implemented, inwhole or in part, using one or more computing devices described withrespect to FIG. 2 . Turning now to FIG. 2 , a computing device 200 thatmay be used with one or more of the computational systems is described.The computing device 200 may comprise a processor 203 for controllingoverall operation of the computing device 200 and its associatedcomponents, including RAM 205, ROM 207, input/output device 209,accelerometer 211, global-position system antenna 213, memory 215,and/or communication interface 223. A bus may interconnect processor(s)203, RAM 205, ROM 207, memory 215, I/O device 209, accelerometer 211,global-position system receiver/antenna 213, memory 215, and/orcommunication interface 223. Computing device 200 may represent, beincorporated in, and/or comprise various devices such as a desktopcomputer, a computer server, a gateway, a mobile device, such as alaptop computer, a tablet computer, a smart phone, any other types ofmobile computing devices, and the like, and/or any other type of dataprocessing device.

Input/output (I/O) device 209 may comprise a microphone, keypad, touchscreen, and/or stylus through which a user of the computing device 200may provide input, and may also comprise one or more of a speaker forproviding audio output and a video display device for providing textual,audiovisual, and/or graphical output. Software may be stored withinmemory 215 to provide instructions to processor 203 allowing computingdevice 200 to perform various actions. For example, memory 215 may storesoftware used by the computing device 200, such as an operating system217, application programs 219, and/or an associated internal database221. The various hardware memory units in memory 215 may comprisevolatile and nonvolatile, removable and non-removable media implementedin any method or technology for storage of information such ascomputer-readable instructions, data structures, program modules, orother data. Memory 215 may comprise one or more physical persistentmemory devices and/or one or more non-persistent memory devices. Memory215 may comprise random access memory (RAM) 205, read only memory (ROM)207, electronically erasable programmable read only memory (EEPROM),flash memory or other memory technology, optical disk storage, magneticcassettes, magnetic tape, magnetic disk storage or other magneticstorage devices, or any other medium that may be used to store thedesired information and that may be accessed by processor 203.

Accelerometer 211 may be a sensor configured to measure acceleratingforces of computing device 200. Accelerometer 211 may be anelectromechanical device. Accelerometer may be used to measure thetilting motion and/or orientation computing device 200, movement ofcomputing device 200, and/or vibrations of computing device 200. Theacceleration forces may be transmitted to the processor to process theacceleration forces and determine the state of computing device 200.

GPS receiver/antenna 213 may be configured to receive one or moresignals from one or more global positioning satellites to determine ageographic location of computing device 200. The geographic locationprovided by GPS receiver/antenna 213 may be used for navigation,tracking, and positioning applications. In this regard, the geographicmay also include places and routes frequented by the first user.

Communication interface 223 may comprise one or more transceivers,digital signal processors, and/or additional circuitry and software,protocol stack, and/or network stack for communicating via any network,wired or wireless, using any protocol as described herein.

Processor 203 may comprise a single central processing unit (CPU), whichmay be a single-core or multi-core processor, or may comprise multipleCPUs. Processor(s) 203 and associated components may allow the computingdevice 200 to execute a series of computer-readable instructions (e.g.,instructions stored in RAM 205, ROM 207, memory 215, and/or other memoryof computing device 215, and/or in other memory) to perform some or allof the processes described herein. Although not shown in FIG. 2 ,various elements within memory 215 or other components in computingdevice 200, may comprise one or more caches, for example, CPU cachesused by the processor 203, page caches used by the operating system 217,disk caches of a hard drive, and/or database caches used to cachecontent from database 221. A CPU cache may be used by one or moreprocessors 203 to reduce memory latency and access time. A processor 203may retrieve data from or write data to the CPU cache rather thanreading/writing to memory 215, which may improve the speed of theseoperations. In some examples, a database cache may be created in whichcertain data from a database 221 is cached in a separate smallerdatabase in a memory separate from the database, such as in RAM 205 oron a separate computing device. For example, in a multi-tieredapplication, a database cache on an application server may reduce dataretrieval and data manipulation time by not needing to communicate overa network with a back-end database server. These types of caches andothers may provide potential advantages in certain implementations ofdevices, systems, and methods described herein, such as faster responsetimes and less dependence on network conditions when transmitting andreceiving data.

Although various components of computing device 200 are describedseparately, functionality of the various components may be combinedand/or performed by a single component and/or multiple computing devicesin communication without departing from the disclosure.

Financial institutions, such as banks, credit card issuers, brokeragehouses, etc., may be privy to a user's transactional history. Financialinstitutions may leverage a user's transaction history as part of amultifactor authentication process. FIG. 3 shows a flow chart of aprocess for performing multifactor authentication according to one ormore aspects of the disclosure. Some or all of the steps of process 300may be performed using one or more computing devices as describedherein, including, for example, first user device 110, second userdevice 120, server 130, or any combination thereof.

In step 310, a server (e.g., an application, such as banking application132, executing on server 130) may receive a request to access anaccount. The request may be received from an application executing on auser device, such as a banking application or a web browser. In someexamples, the request may be received from a user device. In thisregard, the request may be made via a phone call with a customer servicerepresentative. The request to access the account may compriseauthentication information, such as a username and password, a biometricidentifier (e.g., a faceprint, a fingerprint, a voiceprint, an irisscan, etc.), an application identifier, a device identifier, a locationof the user device (i.e., GPS, a network address (e.g., IP address),etc.), phone number, an HTTP cookie, etc.

In step 320, the server (e.g., an application, such as bankingapplication 132, executing on server 130) may determine whethersecondary authentication information should be submitted prior toaccessing the account. The server may determine that secondaryauthentication information should be submitted, for example, if theserver does not recognize one or more of: the application identifier,the device identifier, the location of the user device (i.e., GPS, anetwork address (e.g., IP address), etc.), phone number, an HTTP cookie,etc. Additionally or alternatively, the server may determine thatsecondary authentication information should be submitted, for example,if there were multiple failed password attempts, there was a request toreset a password associated with the account, the user was unable tocorrectly answer security questions, etc. Secondary authenticationinformation may be submitted if the device identifier does not match oneor more previously registered device identifiers. In further examples,the server may request secondary authentication information if useridentification information does not match one or more previouslyregistered pieces of user identification information or the user deviceis unable to provide one or more pieces of user identificationinformation (e.g., mother's maiden name, social security number, date ofbirth, address, etc.). Based on the examples above, one or more of thedata points discussed above (e.g., the application identifier, thedevice identifier, the location of the user device (i.e., GPS, a networkaddress (e.g., IP address), etc.), phone number, the HTTP cookie, etc.)may be registered with the server in advance (e.g., during registrationor from a previous login). If the server determines that secondaryauthentication information is not necessary, the server may provide theuser device with access to the account in step 390.

If the server determines that secondary authentication information isnecessary, the server (e.g., an application, such as banking application132, executing on server 130) may send a request for the secondaryauthentication information to the user device at step 330. In someexamples, the server may send one or more options for the secondaryauthentication information to the user device. The one or more optionsmay comprise verification of a biometric identifier, a one-time password(e.g., one time-code), a proof of purchase, a unique identifier (e.g.,transaction authorization code), etc. The server may receive a selectionof the one or more options for the secondary authentication informationfrom the user device.

In step 340, the server (e.g., an application, such as bankingapplication 132, executing on server 130) may receive the secondaryauthentication information. In some examples, the secondaryauthentication information may be received with the selection of the oneor more options for the secondary authentication information. As notedabove, the secondary authentication information may comprise a biometricidentifier, a one-time password (e.g., one time-code), a proof ofpurchase, etc. The proof of purchase may comprise an image of a receipt,the good, a UPC code, a SKU number, etc. The image may be captured byone or more image capture devices (e.g., camera) of the user device. Thesecondary authentication information may be received via a webpage, atext message from the user device, an application on the user device, anemail associated with the user account, a web portal, an automatedteller machine (ATM), etc.

In step 350, the server may analyze the received secondaryauthentication information. If the secondary authentication informationcomprises a biometric identifier or a one-time password (e.g., onetime-code), the server may verify the biometric identifier and/orone-time password. If the secondary authentication information comprisesa proof of purchase, the server may analyze the image to verify that thesecondary authentication information is a proof of purchase. To verifythat the secondary authentication information is a proof of purchase,the server may use machine learning to validate the proof of purchase.The machine learning model may be a neural network, such as a generativeadversarial network (GAN) or a consistent adversarial network (CAN),such as a cyclic generative adversarial network (C-GAN), a deepconvolutional GAN (DC-GAN), GAN interpolation (GAN-INT), GAN-CLS, acyclic-CAN (e.g., C-CAN), or any equivalent thereof. The neural networkmay be trained using supervised learning, unsupervised learning, backpropagation, transfer learning, stochastic gradient descent, learningrate decay, dropout, max pooling, batch normalization, long short-termmemory, skip-gram, or any equivalent deep learning technique. Themachine learning algorithm may be trained to recognize valid proof ofpurchases, such as receipts, a UPC code, a SKU number, etc. Additionallyor alternatively, the machine learning algorithm may be trained torecognize one or more objects, products, goods, etc., which may becompared to an itemized list of products associated with one or moretransaction records. If the proof of purchase is not deemed valid by themachine learning model, the server may deny the authentication attemptand process 300 may conclude. However, if the proof of purchase isvalid, the server may proceed to analyze the image of the proof ofpurchase to identify the transaction information. In this regard, theserver may analyze the image to identify, for example, transactioninformation. The analysis may comprise computer vision, object characterrecognition (OCR), text-based analysis, or an equivalent thereof. Thetransaction information may comprise at least one of: a logo of amerchant, a date of a transaction, a time of the transaction, a dollaramount of the transaction, an authorization code of the transaction, aplurality of digits of a transaction card used for the transaction, anitem (e.g., good, produce, or service acquired during the transaction),or an equivalent thereof. In some examples, the transaction informationmay comprise an itemized list of items (e.g., goods, services, products,etc.) purchased during the transaction.

In step 360, the server may determine whether the transactioninformation corresponds to one or more records associated with theaccount. In this regard, the server may compare the transactioninformation to one or more transaction records associated with theuser's account. In some examples, the server may determine that thetransaction information corresponds to one or more records associatedwith the account based on the comparison. In some instances, the servermay use fuzzy logic, or an equivalent partial matching algorithm, todetermine whether the transaction information corresponds to one or morerecords. Computer vision, object character recognition (OCR), text-basedanalysis may identify portions of the information contained in the proofof purchase. Additionally or alternatively, computer vision and/or OCRmay be used to identify a logo. The logo may be mapped to one or moremerchant names, for example, stored in a local database. The one or moremerchant names may be used to query the user's transactions to find amatching record. The server may also recognize a plurality letters ofthe merchant and/or an itemized good (e.g., product). In a furtherexample, the server may recognize the day of the transaction, but notthe month. In this regard, the server may determine that a first portion(e.g., the plurality of letters of the merchant and/or the item, thedate of the transaction, etc.) of the transaction information matches asecond portion of the one or more records associated with the account.When the server recognizes partial information from the proof ofpurchase, the server may determine that a plurality (e.g., 2 or more) ofpieces of information from the proof of purchase may match the one ormore records. For example, the server may determine that the partialmerchant name and the amount of the transaction match one or morerecords. In another example, the server may determine that the partialitem name (e.g., good, product, service, etc.) and date of thetransaction match one or more records. Additionally or alternatively,the server may verify one or more portions of the proof of purchase formerchants the user may frequently visit. For instance, if the user makesrepeated purchases from the same merchant, the server may verify aplurality of data points from a proof of purchase associated with themerchant before granting access to the account. As noted above, theserver may determine whether an image comprises an object, good,product, etc. that the user may have recently purchased. In this regard,the server may determine whether the object, good, product, etc.correlates with one or more items associated with one or moretransaction records. In this regard, some transaction records maycomprise an itemized list. The server may determine whether an image ofobject, good, product, etc. correlates with one or more transactionrecords when verifying whether to grant access to the account.Additionally or alternatively, the UPC code and/or the SKU number maymatch one or more items associated with the one or more transactionrecords. If the transaction information does not match one or morerecords associated with the account, the server may deny access to theaccount in step 380.

However, when the transaction information matches one or more recordsassociated with the account, the server may verify the secondaryauthentication information in step 370. Verifying the secondaryauthentication information may comprise determining that the date of thetransaction and/or the time of the transaction is greater than athreshold. That is, the server may determine that the secondaryauthentication information is of a predetermined age. This may providean additional layer of security by preventing a malicious user fromgaining access to the account by making a purchase and using the proofof purchase to access the account. Additionally or alternatively, theserver may determine that secondary authentication information is withina predetermined time frame. In further examples, the server may requirethat the secondary authentication information not be older than a secondthreshold. By imposing time restrictions on the secondary authenticationinformation, the server may prevent a malicious actor from gainingunauthorized access by presenting a proof of purchase from a well-knownand/or common merchant. If the secondary account information isunverified, the server may deny access to account in step 380. However,the server may provide access to the account in step 390 when the serververifies the secondary account information. In some instances, providingaccess to the account may comprise unlocking one or more account-relateddetails, for example, for a customer-service representative to shareduring a phone call.

By having a user submit a proof of purchase associated with atransaction as part of a login process to access an account, the servermay leverage secret transaction history to authenticate the user. As aresult, the security of login attempts may be improved and thelikelihood of an account takeover attempt being successful is reduced.

As discussed above, the multifactor authentication techniques describedabove may be performed when attempting to access an account through amobile application (“app”). FIGS. 4A-4C show an example of themultifactor authentication being performed on a mobile device inaccordance with one or more aspects of the disclosure.

FIG. 4A shows a mobile device 410. Mobile device 410 may be similar tofirst user device 110 and/or second user device 120 discussed above withrespect to FIG. 1 . Mobile device 410 may be executing an application,which may cause login screen 413 to be displayed on mobile device 410.Login screen 413 may comprise a user profile picture 415, a usernamefield 420, a password field 425, and a sign-in button 430. The profilepicture 415 may be set by the user. The user may choose a picture ofhimself/herself, an avatar, or any other suitable image for profilepicture 415. In some instances, profile picture 415 may provide a firstlayer of security. In this regard, if profile picture 415 is not whatthe user expected, then the user may recognize that they are trying tologin to a different account than their account. The username field 420may allow the user to enter (e.g., type) their username for theapplication. Similarly, the password field 425 may allow the user toenter (e.g., type) their password for the application. Once the userenters their username and password, the user may click (e.g., select)sign-in button 430. In response to clicking sign-in button 430, theapplication may send (e.g., transmit) the username and password to aserver for authentication purposes. In some examples, the applicationmay also send additional information to the server, such as anapplication identifier, a device identifier, a phone number associatedwith mobile device 410, a location (i.e., GPS, a network address (e.g.,IP address), etc.) of mobile device 410, an HTTP cookie, or anycombination thereof. The server may verify one or more of the datapoints (e.g., username and password, the application identifier, thedevice identifier, the phone number associated with mobile device 410,the location (i.e., GPS, a network address (e.g., IP address), etc.) ofmobile device 410, the HTTP cookie, etc.). When the data points arevalid, the server may authenticate the user and grant access to theaccount. However, when the data points are invalid, the server mayprompt the user for secondary authentication information.

FIG. 4B shows an example of an interface 433 for inputting secondaryauthentication information. Interface 433 may include prompt 435. Prompt435 may provide an explanation that the user should provide a receiptfrom a receipt transaction as secondary authentication information.Interface 433 may also activate one or more image capture devices onmobile device 410. Accordingly, interface 433 may display focalcrosshairs 440. The focal crosshairs 440 may be used to focus the one ormore image capture devices on an object, such as receipt 445. Mobiledevice 410 may capture an image of receipt 445 and send (e.g., transmit)the image to the server for authentication. While an image capturedevice is shown in FIG. 4B, it will be appreciated that mobile device410 may send (e.g., transmit) the proof of purchase via a text message,email, upload to a web portal, etc. As discussed above, the server mayanalyze the image, for example, using comprise computer vision, objectcharacter recognition (OCR), text-based analysis, or an equivalentthereof. The server may validate the proof of purchase and/or identifyone or more of: a logo of a merchant, a date of a transaction, a time ofthe transaction, a dollar amount of the transaction, an authorizationcode of the transaction, or a plurality of digits of a transaction cardused for the transaction, or an equivalent thereof. After identifyinginformation associated with the image, the server may determine whetherthe date associated with the transaction is of a predetermined age(e.g., is not too recent). If the information is of the predeterminedage, the server may determine whether the information corresponds to oneor more records associated with the account. If the information does notcorrespond to one or more records, then the server may deny access tothe account and the mobile device may return to the login screen 413shown in FIG. 4A.

If the information does correspond to one or more records, mobile device410 may display interface 453, as shown in FIG. 4C. In this regard,interface 453 may cause account information to be displayed on mobiledevice 410, via banking app 450. In this regard, display an accountbalance in account balance field 455. Additionally, a plurality ofrecent transactions may be displayed below the account balance field455. In particular, the plurality of transactions may comprise record460 that corresponds to the transaction associated with receipt 445.Based on record 460, the server may determine that the receipt 445corresponds to and is in the possession of the accountholder.Accordingly, when the user provides receipt 445 as secondaryauthentication information, the server may verify the identity of theuser and provide access to the account. As previously discussed, usingreceipt 445 as part of a multifactor authentication may improve thesecurity of login attempts and reduce the likelihood of account takeoverattempts being successful.

The multifactor authentication techniques may also be performed whensigning-in via a web browser. FIGS. 5A-5D show an example of themultifactor authentication being performed via a web browser inaccordance with one or more aspects of the disclosure.

FIG. 5A shows an example of a web browser 505 displaying a login screen507. Much like the login screen 413 discussed above with respect to FIG.4A, login screen 507 may comprise a user profile picture 510, a usernamefield 515, a password field 520, and a sign-in button 525. The usernamefield 515 may allow the user to enter (e.g., type) their username, andthe password field 520 may allow the user to enter (e.g., type) theirpassword. The user may click (e.g., select) sign-in button 525 afterentering their username and password. The browser 505 may send (e.g.,transmit) the username and password to a server, via an encryptedcommunication channel (e.g., SSL, TLS), for authentication purposes. Thebrowser may also send (e.g., transmit) additional information to theserver, such as a device identifier, a location (i.e., GPS, a networkaddress (e.g., IP address), etc.), an HTTP cookie, or any combinationthereof. The server may verify one or more of the data points (e.g.,username and password, the device identifier, the location (i.e., GPS, anetwork address (e.g., IP address), etc.), the HTTP cookie, etc.). Whenthe data points are valid, the server may authenticate the user andgrant access to the account. However, when the data points are invalid,the server may prompt the user for secondary authentication information.

FIG. 5B shows an example of webpage 527 that prompts the user forsecondary authentication information. In this regard, webpage 527 maycomprise an upload button 530 to upload the proof of purchase.Additionally or alternatively, webpage 527 may comprise a field wherethe user can drag and drop the proof of purchase. While FIG. 5Billustrates uploading the proof of purchase, it will be appreciated thatthe proof of purchase may be sent (e.g., transmitted) via a textmessage, email, etc. The proof of purchase may comprise an image of areceipt, a UPC code, a SKU number, a photo of the good (e.g., product),etc. In some examples, the proof of purchase may comprise an emailreceipt. Browser 505 may send (e.g., transmit) the proof of purchase tothe server for authentication. As discussed above, the server mayvalidate the image and/or analyze the image, for example, using comprisecomputer vision, object character recognition (OCR), text-basedanalysis, or an equivalent thereof to identify, for example, one or moreof: a logo of a merchant, a date of a transaction, a time of thetransaction, a dollar amount of the transaction, an authorization codeof the transaction, or a plurality of digits of a transaction card usedfor the transaction, or an equivalent thereof. After identifyinginformation associated with the image, the server may determine whetherthe date associated with the transaction is of a predetermined age(e.g., is not too recent). If the information is not of thepredetermined age, the server may determine reject the proof ofpurchase. Additionally or alternatively, the server may deny the emailreceipt and request a different proof of purchase, for example, if thereare concerns that the user's email account may be compromised.

When the server rejects the proof of purchase, the server may causewebpage 537 to be displayed on browser 505, as shown in FIG. 5C. In thisregard, webpage 537 may prompt the user for different secondaryauthentication information. Like FIG. 5B, webpage 537 may comprise anupload button 540 to upload the proof of purchase and/or a field wherethe user can drag and drop the proof of purchase. Again, browser 505 maysend (e.g., transmit) the proof of purchase to the server forauthentication. If the information is of the predetermined age and/orthere are no concerns that the user's email may be compromised, theserver may determine validate the proof of purchase by comparing theproof of purchase to one or more records of the user's account'stransaction history. If the information does correspond to one or morerecords, the server may cause webpage 547 to be displayed on web browser505, as shown in FIG. 5D. Webpage 547 may cause account information tobe displayed on browser 505. For example, browser 505 may display aplurality of recent transactions. In particular, the plurality oftransactions may comprise record 550, which corresponds to thetransaction associated with the proof of purchase provided by theaccountholder. Based on record 550, the server may determine that theuser requesting access to the account is valid. As noted throughout,using a proof of purchase as part of a multifactor authentication mayimprove the security of login attempts and reduce the likelihood ofaccount takeover attempts being successful.

The above-described systems, devices, and methods may improve thesecurity of login attempts and reduce the likelihood of account takeoverattempts being successful by using a proof of purchase as part of amultifactor authentication process. As described above, a user maysubmit a proof of purchase associated with a transaction as part of alogin process to access an account. A server may determine informationassociated with the transaction from the proof of purchase, and thendetermine whether the information matches one or more records associatedwith the user's account. When the information matches one or morerecords, the server may authenticate the user and provide access to theaccount. In this way, the server may leverage secret transaction historyknown to the server and the user to authenticate the user. As a furtherprecautionary measure, the server may deny recent proofs of purchase toprevent the malicious user from making a purchase and using the proof ofpurchase to access the account.

One or more features discussed herein may be embodied in computer-usableor readable data and/or computer-executable instructions, such as in oneor more program modules, executed by one or more computers or otherdevices as described herein. Program modules may comprise routines,programs, objects, components, data structures, and the like. thatperform particular tasks or implement particular abstract data typeswhen executed by a processor in a computer or other device. The modulesmay be written in a source code programming language that issubsequently compiled for execution, or may be written in a scriptinglanguage such as (but not limited to) HTML or XML. The computerexecutable instructions may be stored on a computer readable medium suchas a hard disk, optical disk, removable storage media, solid-statememory, RAM, and the like. The functionality of the program modules maybe combined or distributed as desired. In addition, the functionalitymay be embodied in whole or in part in firmware or hardware equivalentssuch as integrated circuits, field programmable gate arrays (FPGA), andthe like. Particular data structures may be used to more effectivelyimplement one or more features discussed herein, and such datastructures are contemplated within the scope of computer executableinstructions and computer-usable data described herein. Various featuresdescribed herein may be embodied as a method, a computing device, asystem, and/or a computer program product.

Although the present disclosure has been described in terms of variousexamples, many additional modifications and variations would be apparentto those skilled in the art. In particular, any of the various processesdescribed above may be performed in alternative sequences and/or inparallel (on different computing devices) in order to achieve similarresults in a manner that is more appropriate to the requirements of aspecific application. It is therefore to be understood that the presentdisclosure may be practiced otherwise than specifically describedwithout departing from the scope and spirit of the present disclosure.Although examples are described above, features and/or steps of thoseexamples may be combined, divided, omitted, rearranged, revised, and/oraugmented in any desired manner Thus, the present disclosure should beconsidered in all respects as illustrative and not restrictive.Accordingly, the scope of the disclosure should be determined not by theexamples, but by the appended claims and their equivalents.

What is claimed is:
 1. A method comprising: sending, by a user device toa server, a request to access an account, wherein the request to accessthe account comprises authentication information; receiving, by the userdevice, a request for secondary authentication information, wherein therequest for secondary authentication information comprises one or moreauthentication options for a user associated with the user device toselect as part of a multifactor authentication process; sending, basedon receiving a selection of a proof of purchase from the one or moreauthentication options, the secondary authentication informationcomprising an image of a receipt; and accessing, based on an amount ofthe receipt matching transaction information associated with theaccount, the account.
 2. The method of claim 1, further comprising:capturing, using an image capture device, the image of the receipt. 3.The method of claim 2, wherein the image capture device comprises one ormore cameras on the user device.
 4. The method of claim 1, wherein thesending the secondary authentication information comprises uploading theimage of the receipt via a web browser.
 5. The method of claim 1,wherein the sending the secondary authentication information comprisessending the image of the receipt via an electronic communication.
 6. Themethod of claim 5, wherein the electronic communication comprises atleast one of a text message or an e-mail.
 7. The method of claim 1,wherein the sending the secondary authentication information comprisesuploading the image of the receipt via an automated teller machine(ATM).
 8. The method of claim 1, wherein the authentication informationcomprises at least one of: a username and password, a biometricidentifier, an application identifier, a device identifier, a phonenumber, a location of the user device, or an HTTP cookie.
 9. The methodof claim 1, wherein the request for the secondary authenticationinformation is received after a predetermined number of failed loginattempts.
 10. The method of claim 1, wherein the user device comprises amobile device.
 11. A computing device comprising: one or moreprocessors; and memory storing instructions that, when executed by theone or more processors, cause the computing device to: send, to aserver, a request to access an account, wherein the request to accessthe account comprises authentication information; receive a request forsecondary authentication information, wherein the request for secondaryauthentication information comprises one or more authentication optionsfor a user associated with the computing device to select as part of amultifactor authentication process; send, based on receiving a selectionof a proof of purchase from the one or more authentication options, thesecondary authentication information comprising an image of a receipt;and access, based on an amount of the receipt matching transactioninformation associated with the account, the account.
 12. The computingdevice of claim 11, further comprising: an image capture deviceconfigured to capture the image of the receipt.
 13. The computing deviceof claim 11, further comprising: an antenna configured to receive one ormore signals used to determine a location of the computing device,wherein the authentication information comprises the location of thecomputing device.
 14. A system comprising: a server; and a user device,wherein the user device is configured to: send, to the server, a requestto access an account, wherein the request to access the accountcomprises authentication information; receive a request for secondaryauthentication information, wherein the request for secondaryauthentication information comprises one or more authentication optionsfor a user associated with the user device to select as part of amultifactor authentication process; send, based on receiving a selectionof a proof of purchase from the one or more authentication options, thesecondary authentication information comprising an image of a receipt;and access, based on an amount of the receipt matching transactionalinformation associated with the account, the account; wherein the serveris configured to: receive the secondary authentication information;perform an image analysis of the image of the receipt to identifytransaction information; verify, based on a determination that thetransaction information corresponds to one or more records associatedwith the account, the secondary authentication information; and provide,based on verification of the secondary authentication information,access to the account.
 15. The system of claim 14, wherein sending thesecondary authentication information comprises at least one of:uploading the image of the receipt via a web browser; sending the imageof the receipt via an electronic communication; or uploading the imageof the receipt via an automated teller machine (ATM).
 16. The system ofclaim 14, wherein the request for the secondary authenticationinformation is received after a predetermined number of failed loginattempts.
 17. The system of claim 14, wherein the user device comprisesa mobile device.
 18. One or more non-transitory media storinginstructions that, when executed, cause a computing device to: send, toa server, a request to access an account, wherein the request to accessthe account comprises authentication information; receive a request forsecondary authentication information, wherein the request for secondaryauthentication information comprises one or more authentication optionsfor a user associated with the computing device to select as part of amultifactor authentication process; send, based on receiving a selectionof a proof of purchase from the one or more authentication options, thesecondary authentication information comprising an image of a receipt;and access, based on an amount of the receipt matching transactionalinformation associated with the account, the account.
 19. The one ormore non-transitory media of claim 18, wherein the instructions, whenexecuted, cause the computing device to send the secondaryauthentication information by performing at least one of: uploading theimage of the receipt via a web browser; sending the image of the receiptvia an electronic communication; or uploading the image of the receiptvia an automated teller machine (ATM).
 20. The one or morenon-transitory media of claim 18, wherein the request for the secondaryauthentication information is received after a predetermined number offailed login attempts.